Facebook admits to improperly sharing data with thousands of third-party app developers TWO YEARS after vowing to improve its protection of user information

  • Facebook pledged additional protections to user data back in 2018  
  • Has repeatedly failed to live up to this promise and now admits another lapse  
  • An unknown number of users have had their data sent to third-party apps 
  • Facebook claims the issue is now fixed but it is unknown what caused the issue and when it was found  

Facebook has again admitted to improperly sharing user data with third-party companies. 

The social media giant vowed to crack down on how much information was sent to independent app developers back in 2018 but has repeatedly failed to do so. 

In a blog post, Konstantinos Papamiltiadis, vice-president of  Platform Partnerships at Facebook, revealed a few sparse details about the latest issue. 

He said around 5,000 apps had recently received data they should not have, including email addresses, birthdays, language and gender of users.  

Facebook says the issue was fixed after it was discovered, but did not state when it was found, how it went undetected for two years, or how many users are impacted. 

MailOnline has approached Facebook for comment.

Scroll down for video  

Facebook has again admitted to improperly sharing user data with third-party companies. The social media giant vowed to crack down on how much information was sent to independent app developers back in 2018 (file)

In 2018, the social media giant announced it would be putting in restrictions on its previously uninhibited flow of user data to app developers. 

This included shutting off the data stream to an app developer if a user did not log in to their product within 90 days. 

It appears this latest instalment in the ongoing saga of Facebook’s privacy debacles stems from a bug which did not shut off the data when the 90-day threshold was reached. 

Details of how this happened, why it was not detected earlier, and what led to its discovery now, remain unknown as Facebook will not disclose details. 

Facebook would not reveal how many users were affected by this breach when asked by MailOnline. 

‘Recently, we discovered that in some instances apps continued to receive the data that people had previously authorized, even if it appeared they hadn’t used the app in the last 90 days,’ Mr Papamiltiadis said in the post. 

‘For example, this could happen if someone used a fitness app to invite their friends from their hometown to a workout, but we didn’t recognize that some of their friends had been inactive for many months.

‘From the last several months of data we have available, we currently estimate this issue enabled approximately 5,000 developers to continue receiving information — for example, language or gender — beyond 90 days of inactivity as recognized by our systems. 

‘We haven’t seen evidence that this issue resulted in sharing information that was inconsistent with the permissions people gave when they logged in using Facebook.

‘We fixed the issue the day after we found it. We’ll keep investigating and will continue to prioritize transparency around any major updates.’

This specific issue appears to now be resolved, but the company has a track record of sub-optimal privacy protection. 

And despite the latest pledge from Mr Papamiltiadis that it is continuing to investigate, the lack of details and spotted history is far from reassuring.   

Late last year, the same Facebook chief issued a statement on a similar situation. 

That issue was to do with groups and gave apps access to information on members, including profile pictures and names.   

‘We know at least 11 partners accessed group members’ information in the last 60 days,’ he said at the time. 

And in 2018, a similar situation arose. In this instance, Mr Papamiltiadis said: ‘We’ve taken a number of steps this year to limit developers’ access to people’s Facebook information, and as part of that ongoing effort, we’re in the midst of reviewing all our APIs and the partners who can access them.’

FACEBOOK’S PRIVACY DISASTERS

July 2019: Facebook data scandal: Social network is fined $5billion over ‘inappropriate’ sharing of users’ personal information

March 2019: Facebook CEO Mark Zuckerberg promised to rebuild based on six ‘privacy-focused’ principles:

  • Private interactions
  • Encryption
  • Reducing permanence
  • Safety
  • Interoperability
  • Secure data storage

Zuckerberg promised end-to-end encryption for all of its messaging services, which will be combined in a way that allows users to communicate across WhatsApp, Instagram Direct, and Facebook Messenger.

December 2018: Facebook comes under fire after a bombshell report discovered the firm allowed over 150 companies, including Netflix, Spotify and Bing, to access unprecedented amounts of user data, such as private messages.

Some of these ‘partners’ had the ability to read, write, and delete Facebook users’ private messages and to see all participants on a thread. 

It also allowed Microsoft’s search engine, known as Bing, to see the name of all Facebook users’ friends without their consent.

Amazon was allowed to obtain users’ names and contact information through their friends, and Yahoo could view streams of friends’ posts.

September 2018: Facebook disclosed that it had been hit by its worst ever data breach, affecting 50 million users – including those of Zuckerberg and COO Sheryl Sandberg.

Attackers exploited the site’s ‘View As’ feature, which lets people see what their profiles look like to other users.  

Facebook (file image) made headlines in March 2018  after the data of 87 million users was improperly accessed by Cambridge Analytica, a political consultancy

The unknown attackers took advantage of a feature in the code called ‘Access Tokens,’ to take over people’s accounts, potentially giving hackers access to private messages, photos and posts – although Facebook said there was no evidence that had been done. 

The hackers also tried to harvest people’s private information, including name, sex and hometown, from Facebook’s systems.

Zuckerberg assured users that passwords and credit card information was not accessed.

As a result of the breach, the firm logged roughly 90 million people out of their accounts as a security measure.

March 2018: Facebook made headlines after the data of 87 million users was improperly accessed by Cambridge Analytica, a political consultancy.

The disclosure has prompted government inquiries into the company’s privacy practices across the world, and fueled a ‘#deleteFacebook’ movement among consumers.

Communications firm Cambridge Analytica had offices in London, New York, Washington, as well as Brazil and Malaysia.

The company boasts it can ‘find your voters and move them to action’ through data-driven campaigns and a team that includes data scientists and behavioural psychologists.

‘Within the United States alone, we have played a pivotal role in winning presidential races as well as congressional and state elections,’ with data on more than 230 million American voters, Cambridge Analytica claimed on its website.

The company profited from a feature that meant apps could ask for permission to access your own data as well as the data of all your Facebook friends.

The data firm suspended its chief executive, Alexander Nix (pictured), after recordings emerged of him making a series of controversial claims, including boasts that Cambridge Analytica had a pivotal role in the election of Donald Trump

This meant the company was able to mine the information of 87 million Facebook users even though just 270,000 people gave them permission to do so.

This was designed to help them create software that can predict and influence voters’ choices at the ballot box.

The data firm suspended its chief executive, Alexander Nix, after recordings emerged of him making a series of controversial claims, including boasts that Cambridge Analytica had a pivotal role in the election of Donald Trump.

This information is said to have been used to help the Brexit campaign in the UK.

Source: Read Full Article